about summary refs log tree commit diff
path: root/src/libstore/download.cc
diff options
context:
space:
mode:
authorEelco Dolstra <edolstra@gmail.com>2017-06-12T14·44+0200
committerEelco Dolstra <edolstra@gmail.com>2017-06-12T14·44+0200
commit847f19a5f7a558252bbde9b4c70efa5f7fac1f4f (patch)
tree42f5b98f0253065f6a10ae02f9fd9d4264990f8b /src/libstore/download.cc
parent7f5b750b401e98e9e2a346552aba5bd2e0a9203f (diff)
Provide a builtin default for $NIX_SSL_CERT_FILE
This is mostly to ensure that when Nix is started on macOS via a
launchd service or sshd (for a remote build), it gets a certificate
bundle.
Diffstat (limited to 'src/libstore/download.cc')
-rw-r--r--src/libstore/download.cc7
1 files changed, 4 insertions, 3 deletions
diff --git a/src/libstore/download.cc b/src/libstore/download.cc
index 63e498f0603a..33ab1f027829 100644
--- a/src/libstore/download.cc
+++ b/src/libstore/download.cc
@@ -221,9 +221,10 @@ struct CurlDownloader : public Downloader
             if (request.head)
                 curl_easy_setopt(req, CURLOPT_NOBODY, 1);
 
-            if (request.verifyTLS)
-                curl_easy_setopt(req, CURLOPT_CAINFO, settings.caFile.c_str());
-            else {
+            if (request.verifyTLS) {
+                if (settings.caFile != "")
+                    curl_easy_setopt(req, CURLOPT_CAINFO, settings.caFile.c_str());
+            } else {
                 curl_easy_setopt(req, CURLOPT_SSL_VERIFYPEER, 0);
                 curl_easy_setopt(req, CURLOPT_SSL_VERIFYHOST, 0);
             }